CVE-2026-8827 is a high-severity SQL Injection vulnerability in the TYPO3 Extension "Address List". The vulnerability arises because the AddressRepository::getSqlQuery() method constructs SQL queries without properly sanitizing user input. However, this method is not called anywhere within the extension by default, so the vulnerability does not pose a direct risk in a default installation. The risk exists if custom extensions invoke this method with untrusted input, potentially exposing the site to SQL injection attacks.
CVE-2026-46724 is a path traversal vulnerability in the TYPO3 Extension "Faceted Search". The file indexer does not properly normalize directory paths, allowing a backend user with permission to edit indexer configurations to index files from arbitrary locations on the server filesystem. This vulnerability affects versions 5.0.0, 6.0.0, and 7.0.0 of the extension. The CVSS 4.0 base score is 5.9, indicating a medium severity level.
CVE-2026-46723 is a medium severity vulnerability in the TYPO3 Extension "Faceted Search". It involves the additional_tables configuration of the page and tt_content indexers, which accepts arbitrary table and field names. This allows a backend user with permission to edit indexer configurations to copy sensitive data from internal TYPO3 tables into the search index, potentially exposing data to unauthorized spheres.
CVE-2026-46722 is a medium severity vulnerability in the TYPO3 Extension "Faceted Search" affecting versions 5.0.0, 6.0.0, and 7.0.0. The issue arises because the OOXML parsing in the file indexer does not disable external entity resolution, allowing crafted xlsx or pptx files placed in indexed directories to trigger local file reads or outbound HTTP requests. The retrieved content can then be written into the search index. No official patch or remediation guidance has been provided yet.
The extension fails to properly sanitize user input before using it in a database query. As a result, an unauthenticated attacker can inject arbitrary SQL through a URL parameter on pages using the "Date Menu of news articles" plugin. Exploitation requires the "Date Menu of news articles" plugin to be in use and the TypoScript/Plugin setting disableOverrideDemand not to be enabled.
The create and edit flows do not restrict which user properties may be submitted and do not enforce access control on the frontend user group assignment. As a result, an attacker can assign an arbitrary frontend user group to a newly registered or edited account, gaining unauthorized access to content and functionality restricted to privileged frontend user groups.
A deserialization vulnerability exists in the TYPO3 Site Crawler extension where the X-T3Crawler-Meta response header is passed directly to PHP's unserialize() function. This allows an attacker who controls a crawled endpoint to inject arbitrary serialized PHP objects, potentially leading to remote code execution on the TYPO3 server. Exploitation requires administrative privileges to configure a crawler-enabled page and to trigger the crawl via a Scheduler task. The vulnerability affects version 12.0.0 and version 0 of the extension. No official patch or remediation guidance is currently available.
Changing backend users' passwords via the user settings module results in storing the cleartext password in the uc and user_settings fields of the be_users database table. This issue affects TYPO3 CMS version 14.2.0.
The extension fails to properly reset the generated MFA code after successful authentication. This leads to a possible MFA bypass for future login attempts by providing an empty string as MFA code to the extensions MFA provider.
The extension fails to verify, if an authenticated user has permissions to access to redirects resulting in exposure of redirect records when editing a page.
The extension fails to properly define allowed classes used when deserializing transport failure metadata. An attacker may exploit this to execute untrusted serialized code. Note that an active exploit requires write access to the directory configured at $GLOBALS['TYPO3_CONF_VARS']['MAIL']['transport_spool_filepath'].
The extension extends TYPO3’ FileSpool component, which was vulnerable to Insecure Deserialization prior to TYPO3-CORE-SA-2026-004 https://typo3.org/security/advisory/typo3-core-sa-2026-004 . Since the related fix is overwritten by the extension, using the extension with a patched TYPO3 core version still allows for Insecure Deserialization, because the affected vulnerable code was extracted from TYPO3 core to the extension. More information about this vulnerability can be found in the related TYPO3 Core Security Advisory TYPO3-CORE-SA-2026-004 https://typo3.org/security/advisory/typo3-core-sa-2026-004 .
TYPO3's mail‑file spool deserialization flaw lets local users with write access to the spool directory craft a malicious file that is deserialized during the mailer:spool:send command, enabling arbitrary PHP code execution on the web server. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.
Backend users who had access to the recycler module could delete arbitrary data from any database table defined in the TCA - regardless of whether they had permission to that particular table. This allowed attackers to purge and destroy critical site data, effectively rendering the website unavailable. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.
Backend users with access to the redirects module and write permission on the sys_redirect table were able to read, create, and modify any redirect record without restriction to the user’s own file-mounts or web-mounts. This allowed attackers to insert or alter redirects pointing to arbitrary URLs – facilitating phishing or other malicious redirect attacks. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.
By exploiting the defVals parameter, attackers could bypass field‑level access checks during record creation in the TYPO3 backend. This gave them the ability to insert arbitrary data into prohibited exclude fields of a database table for which the user already has write permission for a reduced set of fields. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.
Improper Authentication vulnerability in TYPO3 Extension "Modules" codingms/modules.This issue affects Extension "Modules": before 4.3.11, from 5.0.0 before 5.7.4, from 6.0.0 before 6.4.2, from 7.0.0 before 7.5.5.
The extension "Form to Database" is susceptible to Cross-Site Scripting. This issue affects the following versions: before 2.2.5, from 3.0.0 before 3.2.2, from 4.0.0 before 4.2.3, from 5.0.0 before 5.0.2.
Missing authorization checks in the CSV download feature of TYPO3 CMS versions 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to disclose information from arbitrary database tables stored within the users' web mounts without having access to them.
Missing authorization checks in the Workspace Module of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke the corresponding AJAX backend route to disclose sensitive information without having access.